4 ms·

For context of readers, I note you are a FB engineer. Thanks for looking at this. 1. I'm not concerned about harm to users from this issue, I don't pretend to

For context of readers, I note you are a FB engineer. Thanks for looking at this. 1. I'm not concerned about harm to users from this issue, I don't pretend to be. That should be Facebook's role. 2. This isn't a bug or a vulnerability, it's something you've actually coded - a feature. It doesn't 'accidentally' match up the number I've just entered with other people's phonebooks, you've programmed it to do that. Fine, that's a commercial choice made by Facebook (value of engaging new users vs concerns over publicising people's phonebooks) - but reporting it through those links would be nothing more than a complaint letter.

aristus 15y ago
/whitehat is not a "complaint letter". It goes directly to the security team oncall, whose job is to keep users safe even if it means killing things written by other engineers at Facebook that had unintended consequences. (edit: removed snark)
- ma2rten 15y ago
  Well, what I am wondering is: is this actually an unintended consequence or a conscious choice that has been made?
  - deleted 15y ago
    [deleted]
  - orijing 15y ago
    A company doesn't have a single conscience. It may have been a conscious choice by an engineer, or it may have been an unintended consequence of some other code change. Either way, I highly doubt it involved the check-off from a director-level employee. If every decision had to get approval from the management team, then progress would grind to a halt, and Facebook would end up like Microsoft.
    - eric-hu 15y ago
      > A company doesn't have a single conscience. Insightful: while it's seemingly simple and obvious, everyone I know has fallen prey to the opposite belief, myself included.
    - usedtolurk 15y ago
      or Apple?
    - tripzilch 15y ago
      > A company doesn't have a single conscience. And because of that we should hold it with less responsibility than a single person? Even though it holds an order of magnitude more power than a single person? Yeah, how about, no. And about your other remark, that is nonsense. It is very possible to keep those checks to a reasonable level of responsibility and many corporations do so, with proper software engineering principles, without "turning into Microsoft". When dealing with people's private information, one should err on the side of caution, not on the side of $$$, and it is obvious which route facebook took. In fact, they are already in violation of several EU privacy laws, just because their privacy-pissing database has grown out of hand, they collect more data than they have the internal corporate infrastructure for to deal with this amount of private data of EU citizens in a legal manner in Europe. They went way overboard, maybe not in the US, but they are also incorporated in the EU and cannot oblige by our privacy laws because they collected too much data. As far as I'm concerned, Facebook is on the verge of criminal negligence as EU laws for citizen privacy are concerned. So personally, yeah, I think nothing wrong with headlines of "Facebook privacy fuckup", as long as they're behaving like that, singular conscience or not. That's why we have such laws, to keep corporations responsible.
      - orijing 15y ago
        No, I was simply offering a potential explanation for why things happen. Also, I see no need to respond to your hyperboles. I mean, "criminal negligence"? C'mon.
wildmXranat 15y ago
Exactly. It's timely to discuss where the line is drawn in sharing user data. Trickling here and there amounts to what can be summed up as gaping holes. As time went by, it seems that Facebook left behind their mantra of exclusivity and private social circles. They are vigorously facilitating the opposite when you see 'features' like this.
herdcall 15y ago
That FB responded 2 hours after the post here on HN speaks for itself. I had logged some bug reports the regular way, and FB got back after one year. Yes, one year.
- aristus 15y ago
  I'm sorry you had a bad experience. Were you reporting bugs (eg X doesn't work), or a security vulnerability? Where did you report?
scott_s 15y ago
You did not answer his second question: was this before or after you confirmed through SMS that the phone number is actually yours?
jarofgreen 15y ago
> 2. This isn't a bug or a vulnerability, it's something you've actually coded - a feature. It doesn't 'accidentally' match up the number I've just entered with other people's phonebooks, you've programmed it to do that You assume malicious intent. It might be. But it also might be a engineer who thinks "this would be a cool feature" without stopping to think about the ramifications of this. Happens all the time; think of the Google engineer who decided that Buzz should auto-follow your most emailed contacts publicly or the NetFlix competition that outed a lesbian in small town America. Not that I'm saying it's ok if that's the case; it's still a fuck up that needs to be fixed and in general companies need to be better about this - it happens to often. Just saying I would have reported it to FB first and seen what they did. Responsible Disclosure, and all that.
benregenspan 15y ago
Then "privacy fuckup" is a somewhat hyperbolic choice of phrase for this, isn't it? And it's misleading to mention private investigators and law enforcement when the friend list is only shown after the phone number has been verified. The potential privacy compromise here is that people who might've not wanted the user to know that they had them in their synced-to-Facebook phonebook, or may have a secret profile connected to said phonebook, could be unwittingly exposed to the user. As your example of the friend with the hidden gay profile shows, that can have alarming results. I'd say that example's bad enough and worth addressing (even if the answer is just better messaging about how synced phonebooks can be used) and that the PI/law enforcement talk is just muddying the waters.

aristus 15y ago

/whitehat is not a "complaint letter". It goes directly to the security team oncall, whose job is to keep users safe even if it means killing things written by other engineers at Facebook that had unintended consequences. (edit: removed snark)

ma2rten 15y ago
Well, what I am wondering is: is this actually an unintended consequence or a conscious choice that has been made?
- deleted 15y ago
  [deleted]
- orijing 15y ago
  A company doesn't have a single conscience. It may have been a conscious choice by an engineer, or it may have been an unintended consequence of some other code change. Either way, I highly doubt it involved the check-off from a director-level employee. If every decision had to get approval from the management team, then progress would grind to a halt, and Facebook would end up like Microsoft.
  - eric-hu 15y ago
    > A company doesn't have a single conscience. Insightful: while it's seemingly simple and obvious, everyone I know has fallen prey to the opposite belief, myself included.
  - usedtolurk 15y ago
    or Apple?
  - tripzilch 15y ago
    > A company doesn't have a single conscience. And because of that we should hold it with less responsibility than a single person? Even though it holds an order of magnitude more power than a single person? Yeah, how about, no. And about your other remark, that is nonsense. It is very possible to keep those checks to a reasonable level of responsibility and many corporations do so, with proper software engineering principles, without "turning into Microsoft". When dealing with people's private information, one should err on the side of caution, not on the side of $$$, and it is obvious which route facebook took. In fact, they are already in violation of several EU privacy laws, just because their privacy-pissing database has grown out of hand, they collect more data than they have the internal corporate infrastructure for to deal with this amount of private data of EU citizens in a legal manner in Europe. They went way overboard, maybe not in the US, but they are also incorporated in the EU and cannot oblige by our privacy laws because they collected too much data. As far as I'm concerned, Facebook is on the verge of criminal negligence as EU laws for citizen privacy are concerned. So personally, yeah, I think nothing wrong with headlines of "Facebook privacy fuckup", as long as they're behaving like that, singular conscience or not. That's why we have such laws, to keep corporations responsible.
    - orijing 15y ago
      No, I was simply offering a potential explanation for why things happen. Also, I see no need to respond to your hyperboles. I mean, "criminal negligence"? C'mon.

wildmXranat 15y ago

Exactly. It's timely to discuss where the line is drawn in sharing user data. Trickling here and there amounts to what can be summed up as gaping holes. As time went by, it seems that Facebook left behind their mantra of exclusivity and private social circles. They are vigorously facilitating the opposite when you see 'features' like this.

herdcall 15y ago

That FB responded 2 hours after the post here on HN speaks for itself. I had logged some bug reports the regular way, and FB got back after one year. Yes, one year.

aristus 15y ago
I'm sorry you had a bad experience. Were you reporting bugs (eg X doesn't work), or a security vulnerability? Where did you report?

scott_s 15y ago

You did not answer his second question: was this before or after you confirmed through SMS that the phone number is actually yours?

jarofgreen 15y ago

> 2. This isn't a bug or a vulnerability, it's something you've actually coded - a feature. It doesn't 'accidentally' match up the number I've just entered with other people's phonebooks, you've programmed it to do that You assume malicious intent. It might be. But it also might be a engineer who thinks "this would be a cool feature" without stopping to think about the ramifications of this. Happens all the time; think of the Google engineer who decided that Buzz should auto-follow your most emailed contacts publicly or the NetFlix competition that outed a lesbian in small town America. Not that I'm saying it's ok if that's the case; it's still a fuck up that needs to be fixed and in general companies need to be better about this - it happens to often. Just saying I would have reported it to FB first and seen what they did. Responsible Disclosure, and all that.

benregenspan 15y ago

Then "privacy fuckup" is a somewhat hyperbolic choice of phrase for this, isn't it? And it's misleading to mention private investigators and law enforcement when the friend list is only shown after the phone number has been verified. The potential privacy compromise here is that people who might've not wanted the user to know that they had them in their synced-to-Facebook phonebook, or may have a secret profile connected to said phonebook, could be unwittingly exposed to the user. As your example of the friend with the hidden gay profile shows, that can have alarming results. I'd say that example's bad enough and worth addressing (even if the answer is just better messaging about how synced phonebooks can be used) and that the PI/law enforcement talk is just muddying the waters.